Every article about the Cyber Resilience Act, Regulation (EU) 2024/2847, including ours, tells manufacturers what to have in place. It is fair to ask the same of the machinery the Regulation relies on: the bodies that certify, the standards that give a presumption of conformity, the authorities that enforce, the CSIRTs that receive reports. We read the Commission's registers on the day the first obligation applied and the day after. This is what they held.

Notified bodies: none

Article 32 sends important and critical products to a notified body for EU-type examination or full quality assurance, unless a harmonised standard is applied in full. Notified bodies are designated by member states' notifying authorities and listed in the Commission's NANDO database, now part of the Single Market Compliance Space.

On 12 September 2026, the list of bodies notified under Regulation (EU) 2024/2847 with an active notification returned zero results. The Regulation is on the list of legislations a body can be notified for, and thirteen member states have registered a notifying authority that could notify one. None has.

For a manufacturer of a class I, class II or critical product, that means there is at present nobody to send an application to. The Commission's own target, restated in its 2026 guidance, is notified-body capacity by December 2026; the obligation to have used one falls on 11 December 2027.

Harmonised standards: none published

Article 27 gives a presumption of conformity to products that apply harmonised standards whose references are published in the Official Journal. Article 32(2) makes those standards the condition for a class I product to self-assess.

As of September 2026 no harmonised standard under the CRA has been published in the Official Journal. The Commission's July 2026 amendment to the standardisation request moved the two core horizontal standards to a target of 31 October 2026, the vertical standards to 31 December 2026, and the remaining horizontal ones to October 2027, about a year before full application. Until publication, Annex VII, point 5, is answered by describing the solutions adopted, requirement by requirement, and a class I product has no self-assessment route.

Enforcers: seven of 27

Article 52(2) requires each member state to designate a market surveillance authority and register it with the Commission. On 11 September 2026 seven had: Belgium, Cyprus, Finland, France, Germany, Latvia and Slovakia. Thirteen had registered a notifying authority. Twelve had registered neither. The register, state by state.

Coordinator CSIRTs: listed the day before

Article 14 sends reports to the CSIRT designated as coordinator under NIS2 Article 12(1). ENISA published the list of designated coordinators on 10 September, the day before the duty applied, and in two of the 27 states the coordinator is not the national CSIRT the CSIRTs Network lists: Czechia's is NÚKIB, Croatia's is NCSC-HR. The list, state by state. The single reporting platform asks the reporter to pick the coordinator from a drop-down, and ENISA says a notification filed to the wrong one may be invalidated.

The platform: open

ENISA deployed the initial operating capability of the single reporting platform on 11 September 2026, the day Article 14 applied. It runs on EU Login with two-factor authentication, which can be set up before it is needed; ENISA asks manufacturers to register on the platform itself only when they have a notification to file. It is in English only and has no API. This is the one piece of the machinery that was ready on the day, and how it works, field by field, is a separate article.

What this means for a manufacturer

A default product is unaffected. Self-assessment under Annex VIII module A needs neither a notified body nor a harmonised standard; the 22 requirements are met and documented on the manufacturer's own responsibility, and the twelve steps can be completed today.

A class I product has no route yet, and that is worth writing down. Article 32(2) requires either full application of a harmonised standard or a notified body; neither exists. The honest record for such a product in September 2026 is a file built against Annex I with the solutions described, a note that the standard and the body are awaited, and a check every month. When the first body is notified, its queue will be the constraint, which is a reason to have the file ready before it is possible to submit it.

The reporting duty is fully live. None of the gaps above touches Article 14. The platform is open, the CSIRTs exist, and the clocks run.

We keep the counts above under a thirty-day recheck and will update this page when they move; the date at the top is the date they were read.

Sources

  • Regulation (EU) 2024/2847, Articles 14, 27, 32(1) to (4), 36, 52(2), 71(2); Annex VIII.
  • The Commission's Single Market Compliance Space: bodies notified under Regulation (EU) 2024/2847 with active status (zero on 12 September 2026); market surveillance authorities and notifying authorities filtered to the CRA (7 and 13 on 11 September 2026).
  • The Commission's July 2026 amendment to the CRA standardisation request, for the harmonised-standard timeline; the Official Journal, for the absence of published references.
  • ENISA, "The CRA Single Reporting Platform is launched", press release of 11 September 2026.

This is not legal advice, and these are counts read on a date; the registers are public, so the current numbers are one click away.